Hi All,
I'm pulling data from service now through logstash, i have converted few fields like created on, resolved at and closed at, to convert into date values using filter option.
Lets say there are a total of 100 ticekts in servicenow incidents, half of them doesnot have the value for resolved at and closed at because those tickets have not been worked on, and those data are not loaded into elasticsearch.
How do i get complete data into servicenow?
This is my config file.
input {
http_poller {
urls => {
url => "https://demo1.service-now.com/api/now/table/incident?sysparm_display_value=True&sysparm_exclude_reference_link=True&sysparm_fields=number%2Ccategory%2Cpriority%2Cstate%2Cassignment_group%2Cassigned_to%2Cchild_incidents%2Cclose_code%2Cclosed_by%2Cclosed_at%2Ccompany%2Ccmdb_ci%2Ccontact_type%2Csys_created_on%2Csys_created_by%2Cdescription%2Cescalation%2Cimpact%2Cknowledge%2Clocation%2Cproblem_id%2Creassignment_count%2Creopen_count%2Cresolved_at%2Cseverity%2Curgency%2Cu_repeat_incident"
}
request_timeout => 60
proxy => { host => "1.1.1.2" port => "9090" scheme => "http"}
user => "******"
password => "*****"
schedule => { cron => " * * * *"}
codec => "json"
metadata_target => "http_poller_metadata"
}
}
filter
{
split
{
field => "result"
}
}
filter
{
mutate { convert => { "result.reassignment_count" => "integer" } }
mutate { convert => { "result.reopen_count" => "integer" } }
date { match => [ "result.closed_at", "YYYY-MM-dd HH:mm:ss" ]
target => "result.closed_at"
}
date { match => [ "result.resolved_at", "YYYY-MM-dd HH:mm:ss" ]
target => "result.resolved_at"
}
date { match => [ "result.sys_created_on", "YYYY-MM-dd HH:mm:ss" ]
target => "result.sys_created_on"
}
}
output {
elasticsearch {
hosts => ["1.1.1.6:9200"]
index => "servicenow"
}
}
Any advice on how to deal this situation?
Thanks
Gautham